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We present a quantum probabilistic algorithm which tests with a polynomial computational com- 
plexity whether a given composite number is of the Carmichael type. We also suggest a quantum 
algorithm which could verify a conjecture by Pomerance, Selfridge and Wagstaff concerning the 
asymptotic distribution of Carmichael numbers smaller than a given integer. 
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I. INTRODUCTION 

In the last few years the area of quantum computation 
has gained much momentum (for a review see, e.g., ref. 
1^ ) . The power of quantum computers is mainly due to 
the possibility of working with a superposition of |0 > 
and 1 1 > qubits with coefficients being complex numbers 
a and f3, i.e. with states lip >— a\0 > >, providing 

an enormous number of parallel computations by the gen- 
eration of a superposed state of a large number of terms. 
Quantum computers can do unitary transformations and 
(final) measurements inducing an instantaneous state re- 
duction to |0 > or |1 > with the probability |ap or 
respectively [1]. Two of the most important achieve- 
ments so far have been the discoveries of the quantum 
algorithms for factoring integers |^ and for the search of 
unstructured databases 0|, which achieve, respectively, 
an exponential and a square root speed up compared to 
their classical analogues. Another interesting algorithm 
exploiting the above mentioned ones in conjunction is 
that counting the cardinality i of a given set of elements 
present in a flat superposition of states j|] . 

In a recent work we showed how an extended use 
of this counting algorithm can be further exploited to 
construct unitary and fully reversible operators emulat- 
ing at the quantum level a set of classical probabilistic 
algorithms. Such classical probabilistic algorithms are 
characterized by the use of random numbers during the 
computation, and they give the correct answer with a 
certain probability of success, which can be usually made 
exponentially close to one by repetition. The quantum 
randomized algorithms described in ref. |^ also naturally 
select the 'correct' states with a probability and an ac- 
curacy which can be made exponentially close to one in 
the end of the computation, and since the final measuring 
process is only an option which may not be used, they can 
be included as partial subroutines for further computa- 
tions in larger and more complex quantum networks. As 
explicit examples, we showed how one can design poly- 
nomial time algorithms for studying some problems in 
number theory, such as the test of the primality of an 
integer, of the 'prime number theorem' and of a certain 
conjecture about the asymptotic number of representa- 
tions of an even integer as a sum of two primes. 



In this paper we will use the methods of ref. 
to build a polynomial time quantum algorithm which 
checks whether a composite number k is of Carmichael 
type. We start in section II by recalling the main defini- 
tions and properties of Carmichael numbers. In section 
III we describe the quantum algorithm for the test of 
Carmichael numbers. Section IV is devoted to the de- 
scription of a quantum algorithm which counts the num- 
ber of Carmichaels smaller than a given integer. Finally, 
we conclude in section V with some discussion on the 
results obtained. 



II. CARMICHAEL NUMBERS 

Carmichael numbers are quite famous among special- 
ists in number theory, as they are quite rare and very 
hard to test. They are defined as composite numbers k 
such that [7, 8] 



a^-i = 1 



mod k 



(1) 



for every base I < a < k, a and k being relative co- 
primes, or GCD{a, k) — 1. For later convenience, we also 
introduce the function Gk{a) = Q[GCD{a^k)], where 
0[1] — 1 and 8 = otherwise. In particular, it can 
be shown that an integer fc is a Carmichael number if 
and only if k is composite and the maximum of the or- 
ders of a mod fc, for every 1 < a < A: coprime to fc, 
divides k ~ 1. It then follows that every Carmichael 
number is odd and the product of three or more dis- 
tinct prime numbers (the smallest Carmichael number is 
561 = 3 X 11 X 17). Recently, it has also been proven that 
there are infinitely many Carmichael numbers On a 
classical computer, it is hard to test whether a compos- 
ite number k is Carmichael, as it requires 0[fc/loglogfc] 
evaluations of a^~^ mod k. 

In principle, there is a quite straightforward method to 
check whether a composite number k is of the Carmichael 
type, provided a complete factorization of k itself is 
known. The algorithm would use the fact that the num- 
ber of bases 1 < a < fc coprime to k and which sat- 
isfy eq. (|l]), i.e. for which fc is a pseudoprime, can 
be written as F(k) = Y\p GCD{pi — l,k — 1), where 
the Pi's are the prime factors of fc, i.e. k — JJpl [10, 
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11]. If is Carmichael, using Lagrange theorem one 
can easily show that F{k) must be equal to the Eu- 
ler function (/)(fc), which represents the number of inte- 
gers smaller than k and coprime with k. Since, given 
k — Y[Pi} the Euler function is also known and equal to 
(^(fc) = ^ripill ~ 07 the algorithm would only re- 

quire the complete factorization of k and the evaluation 
of F{k) and 0(fc). Unfortunately, since the simple use of 
Shor's quantum algorithm by itself does not look as an 
efficient tool for the full factorization of a composite in- 
teger (as it would require intermediate tests of primality, 
see, e.g., our comments in ref. |6|), this method does not 
look much promising at present. 

Instead, in this paper we will describe a quantum algo- 
rithm which directly tests whether a composite number is 
of Carmichael type without the need of knowing a priori 
a complete factorization of k, but by counting how many 
bases a satisfy condition (0). The power of the algorithm 
relies on a particular property of the function F{k), i.e. 
that for an arbitrary composite integer fc, F divides (j), 
or F{k) = (j){k)/m, with m = 1,2,... (see, e.g., ref. @). 
In particular, if k is Carmichael we have m = 1, while if 
k is not Carmichael we have m > 2. In other words, if 
k is Carmichael, then there are no bases a which do not 
satisfy condition (|l|), while if k is not Carmichael, then 
at least half of the bases a satisfy this condition. It is 
mainly the existence of such a gap which allow us to de- 
sign an efficient quantum probabilistic algorithm for the 
certification of Carmichael numbers. 



III. IS K CARMICHAEL ? 

The main idea underlying our quantum computation 
is the repeated use of the counting algorithm COUNT 
originally introduced by Brassard et al. The algo- 
rithm COUNT makes an essential use of Grover's uni- 
tary operation G for extracting some elements from a 
flat superposition of quantum states, and Shor's Fourier 
operation F for extracting the periodicity of a quan- 
tum state. Grover's unitary transformation is given by 
G = —11^ 5*011^ 5*1, where the Walsh-Hadamard transform 
W is defined as 



W\a >E 



1 

71 



fc-i 



^(-ir>> 



(2) 



6=0 



(with a ■ b being the qubitwise product of a and b), Sq = 
I - 2|0 >< 0| and S"! = / - 2 |w >< w|, where 
\w > are the searched states. Shor's operation is, instead, 
given by the Fourier transform|^ 



fe-i 



2i-Kab/k 



\b>. 



(3) 



The COUNT algorithm can be summarized by the fol- 
lowing sequence of operations: 



COUNT: 

1) (W^|0>)(M^|0>)=E™=o 

2) ->(F®/)Er.=ol"^>G"" 

3) measure |m >. 



|a>)] 



Since the amplitude of the set of states \w > after m 
iterations of G is a periodic function of m, the estimate of 
such a period by Fourier analysis and the measurement 
of the ancilla qubit |m > will give information on the size 
t of this set, on which the period itself depends. The pa- 
rameter P determines both the precision of the estimate 
t and the computational complexity of the COUNT al- 
gorithm (which requires P iterations of G). 

Our quantum algorithm uses COUNT for estimating 
the number tk = </'(fc) — F{k) of bases for which a given 
composite k is not pseudoprime (i.e. the number of bases 
comprimes to k which do not satisfy condition (|l|)), and 
of R ancilla qubits \mi > which will be finally measured. 
At first, we have to select the composite number k, which 
can be done, e.g., by use of the quantum analogue of 
Rabin's randomized primality test |l3| as described in 
ref. and which will take only poly {log k) steps We 
can then proceed with the main core of the quantum 
Carmichael test algorithm, by starting with the state 



>=|0>i ....|0>fl |0>|0>, 



(4) 



act on each of the first R + 1 qubits with a Walsh- 
Hadamard transform W, producing, respectively, the fiat 
superpositions Em io ^ /v^, for i = l,...i?, and 
Ea=o l« > then perform a CTRL - NOT oper- 

ation on the last qubit (i.e., flipping the value of this 
qubit) subject to the condition that the state \a > is co- 



*Note that W\0 F|0 >= YllZl \a > 



^The quantum algorithm for primality test of a given integer 
k counts the number tk of bases 1 < a < fc which are witnesses 
to the compositness of k, i.e. such that Wk{a) = 0, which 
happens when at least one of the two conditions, (i) a''^^ mod 
fc / 1 or [ii) 3 i e [l,m] / gcd(a(*-i)/2\fc) / 1, with k - 
1 = 2'"n, is satisfied (while Wk{a) = 1 if neither (i) nor 
(ii) are satisfied). The algorithm exploits the gap between 
the number of witnesses a with Wk{a) — 0, which, for a 
composite number k = kco is given by tk > 3(fc — l)/4 [10, 
13], while for a prime number k = kpr is given by ik = 0. 
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prime with fc, q and finally act on the \a > qubits with 
an |mi > ....|tok >- 'controlled' Grover operation G™ se- 
lecting the bases \a > for which k is not a pseudoprime 
from those for which it is a pseudoprime. We thus obtain 
the state 



Em,=0 I™1 > Em^=0 > 



P 



P 



|a> |1 > + ^ |a> |0>], (5) 

Gfc=0 

where for G we use Si = I — '2j2zk{a)=Q 1*^ '^'^ "^1' with 
the function Zk{a) defined as Zk{a) — when condition 
(|l|) is not satisfied, and Zk{a) = 1 if condition is 
satisfied. ^ In the following we will also assume that P ~ 
0\poly (log k)], so that the steps required to compute the 
repeated Grover operations Q'^i+----+™r is polynomial in 
logfc. 

We then define the quantities 



sin0, = J| 



(6) 



and 



krm....mR = sin[2(mi + .... + mj^) + l]9k 

lmi....mR = cos[2(mi + .... + ttir) + l]9k, (7) 

where tk is the number of bases a for which Zk{a) — 0, 
and the states 

1 V 



\Bt> 



a > 



(8) 



■'■This can be done, e.g., using a separate routine which runs 
on a classical computer and exploits the Euclid algorithm. 
Otherwise, a unitary transformation representing the \a >- 
controlled Euclid decomposition E{a) can also be easily ob- 
tained by use of I ~ 0[logfc] extra ancilla qubits and by 
building the state \ri = k mod a > \r2 = a mod ri > |r3 = 
n mod r2 > ...In+i = r;_i mod n > |r; mod n+i > \E{a) = 
G[ri+i] >, where the last operation O is performed upon 
the condition that the previous ancilla qubit (r; mod r;+i) 
assumes the value |0 >. The computational complexity of 
this quantum subroutine is polynomial in log k. 

unitary transformation which represents the function 
Zk (a) can be easily performed by adding an extra ancilla qubit 
and building the \a >-controIled state \Zk{a) = Sfa*^^^ mod 
k] >. The operator SiJ^^l"' - ^^^(-l)^''*"'!" > can 
then be easily realized by tensoring the states \a > with 
the ancilla qubit |e >= [|0 > — 11 >]/-\/2 and acting with 
Uz^(a) : |a > |e >^ |a > |e -I- Zk{a) mod 2 >. All the oper- 
ations leading to the evaluation of Zk{a), except the last for 
the phase change, have to be undone again, as usual, before 
acting with 5*1 and G. 



Next we apply Shor's Fourier transform on each of the 
first R ancilla qubits in order to extract the periodicity 9k 
which is hidden in the amplitudes kmi....mR and lmi....mR, 
i.e. we transform > into 

Y^-P-l 2inhmi/P\l ^ 



IV'2 > = 



P 



2i7riRm„/P|7 ^ 



X [{k 

mi m H 

\B'l > +1 

mi mji 1^2 >)|1 > 

+ \Rest > |0 >], (9) 

where the state \Rest > is the result of the operation G™ 
acting on the bases \a > which are not coprime with k. 

Finally, we perform a measurement of the last qubit. 
If we get |0 >, we start again the whole algorithm from 
eq. (i). If, instead, we obtain |1 >, we can proceed since 
eq. (9) is reduced to the state (which contains only bases 
for which Gfe(a) = 1) 

p-i 



h,...lR=0 

="'"'n<'^Hi^i>+i^2» 



(10) 



where we have introduced the following quantities, 



fk = 



P0k 
TT 



0</.<f 



J k — Jk 



R 



{1-R) 



P 



and 



sin7r(/i zfc fk) 
Psm[7r{k±h)/P]' 



(11) 



(12) 



It is easy to see that the probability of measuring the 
last qubit in eq. (j9|) in the state |1 > is given by 
P\iy — 4'{k)/k, which means that (using the asymp- 
totic behaviour 4'{k) ~ fc/ log log k) we require an average 
number Tav — (^^i>)^^ — 0[loglogfc] of steps to obtain 
eq. 

Now, with eq. (^0|) at hand, we can count the bases 
coprime with k for which k is not a pseudoprime. There 
are then two possibilities: either k = kc is Carmichael, 
in which case tk^ — and therefore 9kc = /fee = o^' 
k = kNc is not Carmichael, for which ifc^^ ^ k^c/'^ 
and 9k^c > 7r/4, implying that P/4 < fk^^ < P/2. 
Looking at eq. ([lo|), we can see that, in the case when k 
is Carmichael, G effectively acts as an identity operator, 
so that \tjj3 > simplifies to 
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\lp3 >^ |0 >i 



.|0 >R > 



when k 



(13) 



On the other hand, when k is not Carmichael, almost aU 
of the anciUa qubits in \ip3 > will be in a state different 
from |0 >i ....|0 >i?. In fact, the probability of finally 



measuring |0 
given by 



>i ....|0 >ii when k is not Carmichael is 



P(|0>i ....\0>r) 



sin irfk 
Psin^^ 



2R 



K) 



2R 



< 




(14) 



since we have that fk^^c — P/^- 

The quantum algorithm is probabilistic since, if in the 
final measurement process of the R ancilla qubits we ob- 
tain a state with at least one of the qubits different from 
|0 >, we can declare with certainty that the number k 
is not Carmichael; on the other hand, if all the ancilla 
qubits are in the state |0 >, we can claim with an error 
probability smaller than 0[P^^^] that the number k is 
Carmichael. 

One important feature of the quantum algorithm is 
that clearly, if the intermediate and final measurement 
steps are omitted, it is unitary and fully reversible, and 
as such it can be used as a subroutine unitary transform 
inside a larger and more complicated algorithm (see next 
section). Another crucial feature is the existence of a 
gap between the cardinalities (essentially F{k)) of the 
domain of the test function Zk{a) when k is Carmichael 
and when it is not. 

Finally, the computational complexity of the quantum 
algorithm can be written as Sp ~ 0[kRPSG/(f>{k)], with 
the number of steps required for G given (using P ~ 
0[poly {log k)]) by Sg — 0[poly {log k)], so that we get 
Sp ~ 0[R poly {log k)(loglogk)], which is polynomial in 
logfc. 



IV. COUNTING CARMICHAEL NUMBERS 

One further and interesting problem in which the quan- 
tum algorithm of the previous section can be explicitly 
used is for the test of a conjecture by Pomerance et al. |1J] 
concerning the asymptotic distribution oi Carmichael 
numbers smaller than a given integer N, which, V fixed 
e > and VA^ > No{e), should be lower bounded byQ 



> O 



th 



N 



1{N) 



2+e 



1{N) = ]Sf^°s^i'^°s'^°s'i°sN)/i'^°s'iogN) 



(15) 



** The existence of the upper bound tN\th < 0[Nl{N)~'-^~''>] 
is proven in ref. Q (see also ref. p^). 



The quantum algorithm (which is also discussed in 
more details in ref. |^) consists of a sub-loop which checks 
whether a given composite k is Carmichael, by counting 
the bases for which it is not a pseudoprime, and a main 
loop which counts the number of Carmichaels smaller 
than N. In particular, we have: 



MAIN-LOOP: 

Count tt{fc|fc ^kc < N} using COUNT with G^G 
and 5*1 ^ 5i = 1 — 2^^,^ \kc >< kc\ (parameter Q) 
SUB-LOOP: 
Parallel compositeness and Carmichael certification 
tests V kco < N (parameter P) and (approximate) con- 
struction of Si . 



The construction of the operator Si in the SUB-LOOP 
of the algorithm first needs the selection of composites 
kco < N. This is done, again, using the quantum ran- 
domized primality test described in ref. ||^. In particular, 
one starts with the state 

\^0> = ^ ^ |fc - 1 > |0 >i |0 >2 |0 >3 



X |0>4 |0>G |0>„ 



(16) 



acting on the ancilla qubit |0 >i with F (producing 

the flat superposition X]m=o 1"^ Z"^/^)' '^^ ^^^'^ 
cilia qubit |0 >2 with a |fc — 1 >-'controlled' F (pro- 
ducing the flat superposition X]a=o I"- ^2 /v^) and an 
|m >i-'controlled' G"" (with Grover's G selecting bases 
with Wk{a) = 0), again with an F on the \m >i ancilla 
qubits, then evaluating the function [1 — 0[m-|- 1]] on the 
|0 >c ancilla qubit, and finally undoing all the previous 
operations except the last one, obtaining 



E|fc> |0>1,2 
Y,\k>\C'' >l,2)|0>c 

E|A:>(|0>i.2-|C'^>i,2)|l>. 



|0>3,4,G, (17) 



where jC*^ >i,2 is a correction term which has been de- 
fined in ref. §] and is s.t. 1,2 < C''\C'' >i,2= 1,2 < 
C^IO >i,2= with (3k = {sixnrgk) / {P smirgk/ P), gk = 
P{siicsmy/t^)/Tr, and f3k^^ = 1 {/3k^^ < 2/[V3P]). 

Then, we proceed with the selection of Carmichael 
numbers among the composites kco < N. To do so, one 
has to act on the |0 >3 qubit with F (producing the 

fiat superposition X]m=o I™ -^3 /V^); on |0 >4 with a 
|fc — 1 >- 'controlled' F (producing the superposition of 
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base states J2aZo I" ^4 /v^)i on |0 >c with an \a >4- 
'controUed' Euclid E{a) operation (selecting the a co- 
primes with k), with an |rn >3-'controlled' Grover trans- 
form G™ on the |a >4 qubits (selecting the bases for 
which k is not a pseudoprime), followed by a Fourier 
transform F and a phase change Sq on the ancilla qubit 
\m >3 conditioned upon the last ancilla qubit in \ipi > 
being in the state |1 >c, undo again the previous oper- 
ations (except 5*0, E{a) and the first F on |m >3) and 
finally also undo [1 — 0(to-|- 1)] on the |- >c qubit. In this 
way, defining Si as the sequence of the all these unitary 
transformations, one obtains the state (see FIG. 1) |^ 



^iiv;o> =[(i*>+|s>)|i>G 

+ \REST> |0>G]|0>e, 



(18) 



where 



Vl/> ^-^|](-lf'=|fc-l>|0>i,2. 

2j2\k> IC" >i,2 |0 >3 ^ 



E> 



Vk 



kco,c 



|0>i.2)|e'= >3, 



Fk+i = 1 ioi k = kc and F; 



fc+i 



for k 



"Arc J 



sin $fe = 



_ /</.(fc) 



(19) 



(20) 



\REST > defines the contribution (which, together with 
the state |e'' >3,4 - with norm 3^4 < e'^je'^ >3,4= 4a^ 
- we do not write here for the sake of simplicity) from 
the bases with Gk{a) = 0, and the last qubit selects the 
contribution from the bases with Gfe(a) = 1 (|1 >g) or 
with Gfc(a) = (|0 >g). 



fo>-|7}j 

iO:^ 1 



10^- 

\a>r- 



J 

hF„= 



HED— I 
HZH 



¥ 



f 

Sl|«P;,> 



t^For more details over the quite straightforward but lenghty 
algebra leading to eq. (Esh see ref. M. 



FIG. 1. The quantum network for the construction of the 
state Si\if>o >• Selection of composites is done in |^i >, 
selection of Carmichaels is done in Siltpo >■ The operator C 
is defined as C = 1 — O^+i. 

In particular, one can show that the norm of the cor- 
rection term |i? > in eq. (|l9|) is upper bounded by 



< E\E > 



< 



4 
N 

3P2- 



2^ -^Pk 



(21) 



Moreover, it can be shown that the overall contribu- 
tion to the state (|l^) coming from the bases a for 
which Gk{a) = 1 and the last ancilla qubit is in the 
state |1 >G, i.e. |$ >= > +|£^ >, has a norm 

< $1$ mmiN^^ ttvg. 

Next, Grover's transform G entering the MAIN-LOOP 
of the algorithm, i.e. that counting the total number tjq 
of kc < N, can be written as 

G = U2Si ; U2 = -W^'''>SI'''>W^''\ (22) 

where now the operations VF^^^ and Sq'''' are acting on 
the states |A: >. 

Then, starting from j-i/jg > given by formula (|l^) and 
tensoring it with another flat superposition of ancilla 
states, i.e. 



\m >5 IV^o >, 



(23) 



m—O 



acting on j-^o > with the \m >5-'controlled' G™ and with 
F on I TO >5, and exploiting the linearity of the unitary 
transformation Si when acting on |$ > |1 >g and on 
\REST > |0 >G, after some elementary algebra we get 
(see ref. ^ for more details)^ 



IV'3 > 



1 ^e-«(i-i/Q)|^>^ [e— /Q,(Q) 



X (z|G > +\B >) + e^-/«4'3)(-i|G > +\B >)] 

Q-l 

'|1>G 



m,n— 

+ n E e"'"™"^"^!" >5 

m,n— 

X G'^'IREST > |0 >G, 
where we have defined, similarly to section III, 



(24) 



"We omit |0 >„ in eq. pil) for simplicity. 
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(25) 



the 'good' and 'bad' states, respectively, as 



lg ^ ^ Et„„ I* > |o >.,2 



the 'error' term as 



\En >= SBcOn 



VN-tN 



U2\E>, 



(26) 



(27) 



with Ij = cos(2j 



1)0n, and s„^ as in eq. (|12|). 
Finally, we measure the last ancilla qubit |- >g- If we 
get |0 >G, we start again building the state |i/jo > as 
in eq. (p^). Otherwise, if we get |1 >g (i.e., the part 
of |i/)3 > coming from the bases with Gk{a) — 1), we 
can go on to the last step of the algorithm and further 
measure the first ancilla qubit |- >5 in j-^a >. ^ Using 
the expected estimate that On ^ 0[1/1{NY'^'^/'^], and by 
choosing 



Q ^ 0[1{N) 



13 > l + e/2, 



(28) 



we get the ansatz 1 < /q < (5/2—1, for which it can 
be shown |^ that the probability W to obtain any of t he 
states I/- >5, I/+ >5, \Q - f- >5 or \Q - /+ >5 
the final measurement is given by '^^^ 



W > 



(29) 



This means that with a high probability we will always 
be able to find one of the states |/± >5 or \P — f± >5 
and, therefore, to evaluate the number In from eq. (25). 



Since the probability of measuring the last qubit in eq. 
( p^ in the state |1 >g is given, this time, by P\i>q ~< 
$1$ >, this means that we require only an average number 
Tav — (-P|i>q)~^ — 0[1] of repetitions of the algorithm from 
eq. to eq. (Q. 

***Where /_ = [fg] + 5f and f+ = f- + l, with < <5/ < 1. 
Formula ( [29[ ) is calculated (see ref. ^) from the estimate 
of Wb„ (the contribution coming from terms in eq. ( ]2^ ) in- 
volving \E„ >), using the upper bound < En\En >< 0[n^] < 
E\E > and choosing P ~ c Q, with c ^ 1. An alternative 
to this choice, for reducing the 'error' probability We„, is to 
repeat the counting algorithm a sufficient number of times, as 
done in section III. 



Since in general fq is not an integer, the measured fq 
will not match exactly the true value of /q, and conse- 
quently (defining = TVsin^ 9^, with 9^ — 9iq{fq)) we 
will have an error over t^q [pi given by 



TV 



\^tN\exp = \tN — tN\ < T^-Q 




o 



^ ;(iV)-(i+^/2) 



(30) 



Then, if we want to check the theoretical formula for 
with a precision up to some power 5, with < (5 <C e 
in /(iV), i.e. with 



\MN\th ^ 0[N ?(7V)-(2+^+*)] 



(31) 



we have to impose that |Atjv|exp < |Atjv|t?i, which im- 
plies that we can take Q as given by eq. (^Sj) with 
(3 > I + e/2 + 5.^ The computational complexity 
of the quantum algorithm can be finally estimated as 
Sq ~ 0[QPSg] > 0[/(iV)2+^+2'5], i.e. superpolynomial 
but still subexponential in logA^.^ 



V. DISCUSSION 

Our quantum algorithms testing and counting 
Carmichael numbers make essential use of some of the 
basic blocks of quantum networks known so far, i.e. 
Grover's operator for the quantum search of a database 
m, Shor's Fourier transform for extracting the periodic- 



ity of a function 
algorithm of ref. [ 5| 



and their combination in the counting 
The most important feature of our 
quantum probabilistic algorithms is that the coin tossing 
used in the correspondent classical probabilistic ones is 
replaced here by a unitary and reversible operation, so 
that the quantum algorithm can even be used as a sub- 
routine in larger and more complicated networks. Our 
quantum algorithm may also be useful for other similar 
tests and counting problems in number theory if there ex- 
ists a classical probabilistic algorithm which somehow can 
guarantee a good success probability. Finally, it is known 
that in a classical computation one can count, by using 



"^"'"''One can further minimize the errors (i.e., boost the suc- 
cess probability W exponentially close to one and achieve an 
exponential accuracy) by repeating the whole algorithm and 
using the majority rule 

The contribution from a single Grover's transform is 
Sg — 0[poly (log N)], which is dominated by the contribu- 
tion coming from QP ~ c . Furthermore, the use of R 
ancilla qubits, as done in section III, instead of the choice 
P ■r::^ c Q, would lead to the (subexponential in log A'^) com- 
plexity Sq > /(iV)(i+^/2+5)(i+i/fl)^ 
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Monte-Carlo methods, the cardinality of a set which sat- 
isfies some conditions, provided that the distribution of 
the elements of such a set is assumed to be known (e.g., 
homogeneous). One further crucial strength and novelty 
of our algorithm is also in the ability of efficiently and 
successfully solve problems where such a knowledge or 
regularities may not be present. 
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